linux-kernel - Re: Kernel oops with netfilter: nf_tables: incorrect error path handling with NFT_MSG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ttuuajbo.fsf@43-1.org>
Date:   Mon, 26 Jun 2023 00:22:51 -0500
From:   Matthias Maier <tamiko@...1.org>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        netfilter-devel@...r.kernel.org
Subject: Re: Kernel oops with netfilter: nf_tables: incorrect error path
 handling with NFT_MSG_NEWRULE

Hi Pablo,

Thanks a lot for the quick reponse!


On Sun, Jun 25, 2023, at 18:05 CDT, Pablo Neira Ayuso <pablo@...filter.org> wrote:

> [...]
>
> Could you give a try to these two fixes on top?
>
> 26b5a5712eb8 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
> 4bedf9eee016 netfilter: nf_tables: fix chain binding transaction logic

These two patches alone were not enough, I had to apply the third patch
you mentioned:

> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230625224219.64876-1-pablo@netfilter.org/

With all three patches I do not run into the oops any more.


Nevertheless, please find below a (somehwat minimal) reproducer. Loading
this ruleset into nft_tables via  $ nft -f reproducer.ruleset  previously
oopsed the kernel.

Best,
Matthias



define guarded_ports = {ssh}

table inet portknock {
        set clients_ipv4 {
                type ipv4_addr
                flags timeout
        }

        set candidates_ipv4 {
                type ipv4_addr . inet_service
                flags timeout
        }

        chain input {
                type filter hook input priority -10; policy accept;

                tcp dport 10001 add @candidates_ipv4 {ip  saddr . 10002 timeout 1s}
                tcp dport 10002 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10003 timeout 1s}
                tcp dport 10003 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10004 timeout 1s}
                tcp dport 10004 ip  saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip  saddr . 10005 timeout 1s}
                tcp dport 10005 ip  saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip  saddr timeout 600s} log prefix "Successful portknock: "

                tcp dport $guarded_ports ip  saddr @clients_ipv4 counter accept
                tcp dport $guarded_ports ct state established,related counter accept

                tcp dport $guarded_ports reject with tcp reset
        }
}